Set up permissions to github workflows

[joycebrum]

I have suggested a PR to setuptools repo to harden permissions to the github workflows pypa/setuptools#3833, if that's ok, I also would like to do the same to the packaging repo in order to increase supply-chain security by limiting the impact of an eventual compromised workflow.

Let me know if a PR is also welcome in this repo and I'll submit it ASAP.

[pradyunsg]

Thanks for flagging! I've set the default permissions in the settings for the repo to read, instead of needing to modify the workflows directly.

If someone is able to compromise/modify the settings of this repo, we're already compromised at that point so I reckon this is good enough! :)